BIT-NODE-2026-58039

A flaw in Node.js Permission Model enforcement allows process.report writes and overwrites files outside --allow-fs-write paths. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects Node.js 22.x, 24.x, and 26...

PT-2026-73434

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From v1.51.0 until v1.75.0, the local backend in backend/local/local.go relies on the configurable filename encoder to prevent remote filename data from becoming operating-system path...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: postgresql (UTSA-2026-099513)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099513 advisory. Symlink following in PostgreSQL pgbasebackup plain format and in pgrewind allows an origin superuser to overwrite local files, e.g. /var/lib/postgres/.bashrc, that...

Unity Linux 20.1070e Security Update: gzip (UTSA-2026-099505)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099505 advisory. GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the users PATH, gzexe...

PT-2026-73398

A flaw in Node.js Permission Model enforcement allows process.report writes and overwrites files outside --allow-fs-write paths. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects Node.js 22.x, 24.x, and 26...

PT-2026-73284

Ghost is a Node.js content management system. From 1.20.1 until 6.54.1, an Administrator-level user could remotely overwrite certain files on the filesystem through the database backup filename, leading to integrity and availability issues. The database export endpoint failed to reject path...

Unity Linux 20.1070a Security Update: libpq (UTSA-2026-099547)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099547 advisory. Symlink following in PostgreSQL pgbasebackup plain format and in pgrewind allows an origin superuser to overwrite local files, e.g. /var/lib/postgres/.bashrc, that...

SUSE CVE-2026-66898

A path traversal vulnerability in LXD allows an attacker to manipulate file system paths during backup import and restore operations. When importing or restoring a backup archive, LXD fails to validate instance and storage volume names contained within the archive metadata. An attacker can exploi...

EUVD-2026-58742

Emlog is an open source website building system. In 2.6.26 and earlier, install.php accepts action=reinstall without authentication and deliberately skips the already-installed check because the guard runs only when $act != 'reinstall'. A remote attacker can submit hostname, dbuser, dbpasswd,...

CVE-2026-73624

A flaw was found in GitPython. This vulnerability allows a remote attacker to overwrite arbitrary files on the system. By failing to properly validate git options passed to the Diffable.diff method, an attacker can supply a malicious output argument to write patch content to attacker-controlled...

Directory Traversal

Spring Integration is vulnerable to Directory Traversal. The vulnerability is due to insufficient validation of file paths received from malicious or compromised FTP/SFTP/SMB servers, which allows an attacker to write arbitrary content to files outside the configured local directory...

CVE-2026-63308 vulnerabilities

Vulnerabilities for packages: helm...

GO-2026-5273 vulnerabilities

Vulnerabilities for packages: goreleaser...

GO-2023-2071 vulnerabilities

Vulnerabilities for packages: croc...

GO-2026-5558 vulnerabilities

Vulnerabilities for packages: opentofu...

GO-2026-5284 vulnerabilities

Vulnerabilities for packages: minio...

GO-2023-2068 vulnerabilities

Vulnerabilities for packages: croc...

GO-2023-2072 vulnerabilities

Vulnerabilities for packages: croc...

CVE-2026-73076

A vulnerability in Vim allows remote attackers to execute arbitrary commands by crafting a malicious .VimballRecord file that injects OS commands executed when processed by the vimballRmVimball function. Mitigation Avoid installing or removing vimballs from untrusted sources. This vulnerability...

Linux Distros Unpatched Vulnerability : CVE-2026-73624

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitPython versions before 3.1.54 contain an arbitrary file overwrite vulnerability in the Diffable.diff method that fails to validate git options passed through...